I know that @RolesAllowd annotation can be used to provide role-based access control to REST endpoints and I am currently using that with RestEASY.

I need to know how it is working behind the scenes. Can anybody please explain to me how Java validates the roles mentioned in the annotation.

So far I managed to figure out that the roles are stored in the UserPrincipal of the HttpServletRequest.

closed as off-topic by gnat, amon, Jörg W Mittag, Eric King, Greg Burghardt Jan 10 at 20:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for assistance in explaining, writing or debugging code are off-topic here. These can be asked on Stack Overflow if they include the desired behavior, a specific problem or error, and the shortest code necessary to reproduce it in the question (see Minimal, Complete, and Verifiable Example)." – amon, Eric King, Greg Burghardt
If this question can be reworded to fit the rules in the help center, please edit the question.


If you are using RESTEasy outside of an EJB container, and have enabled resteasy.role.based.security, then according to the RESTEasy documentation,

How does Resteasy do authorization? Well, its really simple. It just sees if a method is annotated with @RolesAllowed and then just does HttpServletRequest.isUserInRole. If one of the @RolesAllowed passes, then allow the request, otherwise, a response is sent back with a 401 (Unauthorized) response code.

The implementation of HttpServletRequest (and therefore what the source of isUserInRole is) varies by provider/container; Apache may have different implementation than Oracle. Some providers, such as Apache, also have multiple implementations of HttpServletRequest.

If you are in an EJB container, then the container will be provide the functionality. And again, depending on the container, the implementation may differ slightly.

Not the answer you're looking for? Browse other questions tagged or ask your own question.